I got an invitation from gmail team today…

I think they have started sending invitations to the ones who had subscribed to “Receive gmail updates in mail”

so in that mail..there is a link to “unsubscribe yourself” from the list…

I clicked it and tried entering script code in that…it did not work…I tried again by adding ” and then finally it worked after adding “> in variable email

Wanna see it action ?

Check the screenshot

You will see javascript alert saying “Hi”, I am sure you know what all you can do with it

I have already mail google security team about this, I think they should fix this small issue in few hours…

UPDATE: They are so quick….I got reply from them in less than an hour…very impressive…. where our Indiatimes, They have still not replied to my mail…they should learn something from google..

This is what I got from them

Hi Deep,

Thanks for letting us know! We will fix this problem as soon as possible.

Also, if you would like a Google T-shirt, please send us your mailing address and t-shirt size, and we’ll send a shirt.

Thanks
Google Security Team